How can I reset or lower the serial used in BIND DNS server's SOA record?

Question

I use BIND as my DNS server at home. For my Start Of Authority (SOA record) I always use a serial in the recommended format

YYYYMMDD##

where ## is the counter for changes on that day.

Unfortunately I changed the serial and added 1 more digit by mistake. After updating the name-daemon, I couldn't revert this anymore.

Is there a possible way to reset the serial / counter inside BIND's internal libraries?

I found a solution on http://serverfault.com/questions/158021/changing-dns-serial-number-to-be-in-the-past — Master of Celebration, Apr 19 '12 at 14:32

score 15 · Answer 1 · edited Jul 09 '18 at 00:27

15

If you have shell access to all slave servers, there is a simpler solution:

To be able to decrement a serial number on slave servers, you can log into the slave server and run rndc retransfer my.zone.name. This will cause the slave to fetch the zone from the master and completely ignore the serial number.

edited Jul 09 '18 at 00:27

jeyk

103
3

answered Apr 19 '12 at 22:36

phemmer

70,657
19
188
223

2

Yeah, well, that's assuming you have access to every one of the slave servers or else you want to ask the administrator of each one to run that command for you. – Celada Apr 26 '12 at 17:01
1

Very useful, have an upvote! Still, since the other answer is neither unnecessary nor old, you might want change your first line to something like "There is a simpler solution if you have shell access to all slave servers: ". – Heinzi Jan 16 '18 at 12:56

score 10 · Accepted Answer · answered Apr 19 '12 at 17:51

"BIND's internal libraries" don't care what the serial number is. It's only agreement between the master server and slave servers that matters. In other words, BIND will happily let you decrease the serial number in a zone file without complaint.. It's just that the slaves would no longer receive updates.

Zone file serial numbers are unsigned 32-bit integers and they wrap around the largest possible 32-bit unsigned integer. So there is a way to decrease the serial number by incrementing it repeatedly until it rolls over and becomes closer to zero. There is a maximum amount by which you can increment it at a time, so you have to do this iteratively in multiple steps:

Increase the serial number by a large increment but no more than 2147483647
Wait for all of the slave servers to catch up and be up to date with the current SOA.
Repeat

You can always pick an increment such that you don't need to iterate more than twice.

Follow this HOWTO.

How can I reset or lower the serial used in BIND DNS server's SOA record?

2 Answers2